CLONE_NEWUSER|CLONE_FS root exploit
From: Kees Cook
Date: Wed Mar 13 2013 - 13:58:21 EST
It seem like we should block (at least) this combination. On 3.9, this
exploit works once uidmapping is added.
----- Forwarded message from Sebastian Krahmer <krahmer@xxxxxxx> -----
Date: Wed, 13 Mar 2013 16:39:56 +0100
From: Sebastian Krahmer <krahmer@xxxxxxx>
Subject: [oss-security] CLONE_NEWUSER|CLONE_FS root exploit
Seems like CLONE_NEWUSER|CLONE_FS might be a forbidden
During evaluating the new user namespace thingie, it turned out
that its trivially exploitable to get a (real) uid 0,
as demonstrated here:
The trick is to setup a chroot in your CLONE_NEWUSER,
but also affecting the parent, which is running
in the init_user_ns, but with the chroot shared.
Then its trivial to get a rootshell from that.
Tested on a openSUSE12.1 with a custom build 3.8.2 (x86_64).
I hope I didnt make anything wrong, mixing up the UIDs,
or disabled important checks during kernel build on my test
~ perl self.pl
~ krahmer@xxxxxxx - SuSE Security Team
----- End forwarded message -----
Chrome OS Security
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/